DSCResources/MSFT_ADFineGrainedPasswordPolicy/en-US/about_ADFineGrainedPasswordPolicy.help.txt
|
.NAME
ADFineGrainedPasswordPolicy .DESCRIPTION The ADFineGrainedPasswordPolicy DSC resource will manage an Active Directory domain's fine grained password policies. ## Requirements * Target machine must be running Windows Server 2012 or later. .PARAMETER Name Key - String Specifies an Active Directory fine-grained password policy object name. .PARAMETER Precedence Required - UInt32 Specifies a value that defines the precedence of a fine-grained password policy among all fine-grained password policies. .PARAMETER DisplayName Write - String Specifies the display name of the object. .PARAMETER Description Write - String Specifies the description of the object. .PARAMETER Subjects Write - StringArray Specifies the ADPrincipal names the policy is to be applied to, overwrites all existing. .PARAMETER Ensure Write - String Allowed values: Present, Absent Specifies whether the fine-grained password policy should be present or absent. Default value is 'Present'. .PARAMETER ComplexityEnabled Write - Boolean Specifies whether password complexity is enabled for the password policy. .PARAMETER LockoutDuration Write - String Specifies the length of time that an account is locked after the number of failed login attempts exceeds the lockout threshold. The lockout duration must be greater than or equal to the lockout observation time for a password policy. The value must be a string representation of a TimeSpan value. .PARAMETER LockoutObservationWindow Write - String Specifies the maximum time interval between two unsuccessful login attempts before the number of unsuccessful login attempts is reset to 0. The lockout observation window must be smaller than or equal to the lockout duration for a password policy. The value must be a string representation of a TimeSpan value. .PARAMETER LockoutThreshold Write - UInt32 Specifies the number of unsuccessful login attempts that are permitted before an account is locked out. .PARAMETER MinPasswordAge Write - String Specifies the minimum length of time before you can change a password. The value must be a string representation of a TimeSpan value. .PARAMETER MaxPasswordAge Write - String Specifies the maximum length of time that you can have the same password. The value must be a string representation of a TimeSpan value. .PARAMETER MinPasswordLength Write - UInt32 Specifies the minimum number of characters that a password must contain. .PARAMETER PasswordHistoryCount Write - UInt32 Specifies the number of previous passwords to save. .PARAMETER ReversibleEncryptionEnabled Write - Boolean Specifies whether the directory must store passwords using reversible encryption. .PARAMETER ProtectedFromAccidentalDeletion Write - Boolean Specifies whether to prevent the object from being deleted. .PARAMETER DomainController Write - String Specifies the Active Directory Domain Services instance to connect to. .PARAMETER Credential Write - Instance Specifies the user account credentials to use to perform this task. .EXAMPLE 1 This configuration will create an Active Directory domain fine-grained password policy with default settings. Configuration ADFineGrainedPasswordPolicy_ConfigurePolicyWithDefaults_Config { Import-DscResource -Module ActiveDirectoryDsc Node localhost { ADFineGrainedPasswordPolicy 'FineGrainedPasswordPolicy' { Name = 'DomainUsers' Precedence = 10 } } } .EXAMPLE 2 This configuration will create an Active Directory domain fine-grained password policy with specific settings. Configuration ADFineGrainedPasswordPolicy_ConfigurePolicyWithSpecifics_Config { Import-DscResource -Module ActiveDirectoryDsc Node localhost { ADFineGrainedPasswordPolicy 'FineGrainedPasswordPolicy' { Name = 'DomainAdmins' DisplayName = 'Domain Admins Password Policy' Description = 'This is the Fine Grained Password Policy for Domain Admins' Subjects = 'Domain Admins' ComplexityEnabled = $true LockoutDuration = '00:30:00' LockoutObservationWindow = '00:30:00' LockoutThreshold = 5 MaxPasswordAge = '42.00:00:00' MinPasswordAge = '1.00:00:00' MinPasswordLength = 15 PasswordHistoryCount = 24 ReversibleEncryptionEnabled = $false ProtectedFromAccidentalDeletion = $true Precedence = 10 } } } .EXAMPLE 3 This configuration will remove an Active Directory domain fine-grained password policy. Configuration ADFineGrainedPasswordPolicy_RemovePolicy_Config { Import-DscResource -Module ActiveDirectoryDsc Node localhost { ADFineGrainedPasswordPolicy 'FineGrainedPasswordPolicy' { Name = 'DomainUsers' Precedence = 10 Ensure = 'Absent' } } } |